Choice, not chance

How to select the right Internal Audit model for your organization

Internal Audit (IA) should be a central component to an organization’s overall business model. Internal audit not only provides assurance to senior leadership that their organization’s governance, internal control processes and risk management practices are operating effectively, but can also be leveraged to seek efficiencies within the business (i.e. a proactive management tool).

Now we are not here to discuss the role of IA or what its mandate should be, but rather we’re discussing the various structural operating models available for organizations to utilize. Let’s look at the three models used most by organizations: 

  • In-house: the IA group consists entirely of employees within the organization; this includes ownership of all methodologies, technology, and knowledge.  
  • Co-sourced: the IA group consists of a combination of an organization’s employees and personnel (as-needed) from a third party provider; this may also include access to other benefits such as the third party’s methodologies, technology, and knowledge.
  • Out-sourced: the IA group consists only of personnel from a third party provider, including access to all methodologies, technology, and knowledge.

So how is an organization supposed to choose? Having worked with a wide array of gaming organizations globally, we know that there are a number of qualitative and quantitative factors which need to be considered, and there is definitely no one-size-fits all solution. Regardless of the size, whether a multinational operating in multiple jurisdictions or a single-product gaming entity supplying only one region, organizations should evaluate each to decide which model is best for their needs. 

Quantitative advantages or disadvantages are usually the easiest to comprehend. Any CFO should be able to list out the specific cost impact of each option. Qualitative factors are often tougher to assess. Qualitative factors can include, among others: the number of geographic locations; level of M&A activity; complexity of business processes and the supporting IT systems; and the magnitude of regulatory oversight (which is obviously high within the gaming industry).

To summarize each model and determine which type is best for implementing within your organization, we’ve created a quick snapshot of characteristics of each for you to consider:

Characteristics

In-house

Co-sourced

Out-sourced

Institutional knowledge retained

High

High

Low

Ability to leverage existing internal relationships

High

Medium

Low

Flexibility of staffing model

Low

Medium

High

Cost efficiency (e.g. creation of variable cost centre)

N/A

Medium

High

Access to subject matter experts

Low

High

High

Knowledge transfer to existing staff

High

High

Low

Access to emerging best practices and knowledge

Low

Medium

High


One thing to keep in mind is that an internal audit model needs to fit the organization, rather than the other way around. An IA model should be regularly assessed as your organization grows, matures, and/or changes. Too often organizations become ‘comfortable’ with how things have always been done and we find this can often lead to an ineffective IA function. We suggest that our clients consider adding the topic to their Board of Directors or Audit Committee meetings annually, in order to assess the effectiveness of their current approach.

Now we know that choosing the right internal audit model may not be as easy as purchasing a lottery ticket, but the odds that it pays out are likely much higher.  

To receive the latest news and insights from our experts, please register for our publications

About Richter : Founded in Montreal in 1926, Richter is a licensed public accounting firm that provides assurance, tax and wealth management services, as well as financial advisory services in the areas of organizational restructuring and insolvency, business valuation, corporate finance, litigation support, and forensic accounting. Our commitment to excellence, our in-depth understanding of financial issues and our practical problem-solving methods have positioned us as one of the most important independent accounting, organizational advisory and consulting firms in the country. Richter has offices in both Toronto and Montreal. Follow us on LinkedIn, Facebook, and Twitter.